Lesson Plan Title: Session Fixation

Concept / Topic To Teach:
How to steal a session with a 'Session Fixation'

How the attacks works:
A user is recognized by the server by an unique Session ID. If a user has logged in and is authorized he does not have to reauthorize when he revisits the application as the user is recognized by the Session ID. In some applications it is possible to deliver the Session ID in the Get-Request. Here is where the attack starts.

An attacker can send a hyperlink to a victim with a chosen Session ID. This can be done for example by a prepared mail which looks like an official mail from the application administrator. If the victim clicks on the link and logs in he is authorized by the Session ID the attacker has chosen. The attacker can visit the page with the same ID and is recognized as the victim and gets logged in without authorization.

General Goal(s):
This lesson has several stages. You play the attacker but also the victim. After having done this lesson it should be understood how a Session Fixation in general works. It should be also understood that it is a bad idea to use the Get-Request for Session IDs.

Solution:
This lesson has 4 stages. In stage 1 and 4 you are Hacker Joe in lesson 2 and 3 you are the victim Jane.

Stage 1:
You have to send a prepared mail to Jane which looks like a mail from Goat Hills Financial with a link containing a Session ID. The mail is already prepared. You only have to alter the link so it includes a Session ID (SID). You can archive this by adding &SID=WHATEVER to the link. Of course can WHATEVER be replaced by any other string. The link should look similar to following:
<a href=http://localhostattack?Screen=46&menu=320&SID=WHATEVER>

Figure 1: Prepared Mail

Stage 2:
Now you are Jane which receives the mail you wrote in stage 1. Point with the mouse on the link and you will notice the SID in the status bar of your browser. This is the easiest stage as you have only to click on the link 'Goat Hills Financial'.

Figure 2: Received Mail

Stage 3:
You are on the login screen of Goat Financial Hills now. In the URL is the SID visible. All you have to do is to log in with your user name Jane and your password tarzan.

Figure 3: Goat Hills Financial Login Screen

Stage 4:
The application switches again to the hacker Joe. There is already a prepared link you have to click on to reach the Goat Hill Financial. In real life this would be different of course. You could directly put the URL in the address bar of your browser.
After having clicked on the provied link you reach Goat Hill Financial. Take a look at the URL and you will see that your SID is NOVALIDSESSION. Change this string to the SID you have chosen at the beginning of this lesson and hit enter.

Figure 4: Browser Address Bar Before Changes
Figure 5: Browser Address Bar After Changes
Congratulation! You are logged in as Jane and the lesson was successful.
Figure 6: Successful Completion Of The Lesson